javascript to prevent download of external js

Forum Moderators: open

Message Too Old, No Replies

javascript to prevent download of external js

Robber

5:33 pm on Apr 20, 2004 (gmt 0)

This might sound strange but it seems that websites on one of our servers are getting a line of code added just before the </body> that calls an external js. (its some russian outfit - scansoft.ruweb.net)

When viewing the source html on the actual webserver the malicious line of code is definitely, 100% not present.

We have done a full server re-install (which was pretty painful) and hoped this would sort it (we found a rootkit on the system which is now not there. -basically we started from scratch.

But this external js call is still appearing. I really dont know how to stop it from getting there (I have used AV software and adaware oin the client and it still comes up), so I am wondering, is there some javascript that I can embed in my pages that will prevent any other external javascript calls from being executed? At least this bodge will stop it from doing harm as a short term measure.

Any help would be extremely appreciated.

Many thanks

Robber

5:46 pm on Apr 20, 2004 (gmt 0)

Had a couple of theoretical thoughts, but js isn't my forte, do they sound feasible:

1) Have js in <head> that looks for a pattern matching something resembling <script src="blah....>, if it finds it change the src attribute to "dummy.js" which would just be empty so as to get no browser errors.

2) Similar to above but if it finds a <script> tag put html comments around it, eg

Possible?

john_k

5:59 pm on Apr 20, 2004 (gmt 0)

I think your time would be better spent finding the source. Obviously >something< on your system is still compromised.

You said that you started from scratch. I'm assuming that means you formatted the hard-drive and reinstalled the OS, then copied the web site files back to the server. If you did something else, please elaborate.

If you did do that, then check for any files pertaining to the site configuration.

You didn't state what web server you are using, but it sounds like its probably Apache or some Linux based server. I don't know the name of the file, but I am pretty sure there is specific file name that is used for inserting a standard footer. (it may be the htaccess file, someone else can pipe in here)

stevenmusumeche

6:06 pm on Apr 20, 2004 (gmt 0)

It sounds like something on your client computer, not the server. Have you tested this on other computers?

Robber

6:23 pm on Apr 20, 2004 (gmt 0)

Hi Guys,

Thanks for chipping in.

I would dearly love to find the actual source, just cant track it down.

John, regarding "starting from scratch" we actually had a new hard drive put in. The website folder on the old machine was scanned for viruses (it was clean) and put back up. The os linux suse

I've checked .htaccess and cant see anything.

Steve, these results are now happening on 4 machines we have tested, 2 are on the same lan. I am sure their is a client side element, but how does it get onto the client and why, when its only the cient would it only affect sites on that server (1 IP address)? It sounds as if the server somehow puts the code in on the fly, when viewed in a browser this then attempts to download a virus (Bloodhound.Exploit.6) amongst others.

I must admit, I am totally bamboozled!

jomaxx

7:04 pm on Apr 20, 2004 (gmt 0)

My bet would still be on spyware. Did you trying doing a GET from the linux command line? Does it happen on every machine you test with? On every type of browser? Is the site in your profile affected?

Robber

7:18 pm on Apr 20, 2004 (gmt 0)

Hi jomaxx,

I dont know if its is every machine, but our webhosst downloaded a page and got the exploit.. blocked by the AV.

Could you show me the code for doing a get on command line?

Site in profile is infected.

One other thing I should add is that its intermitent, even on machines that have the problem it doesn't happen every time.

Cheers

jomaxx

11:14 pm on Apr 20, 2004 (gmt 0)

The syntax is exactly how it appears in your log file, e.g.:
GET [example.com...]

You might want to do it this way so you can page through the file at your leisure:
GET [example.com...]

jomaxx

11:22 pm on Apr 20, 2004 (gmt 0)

Hmm. It's not being inserted by that stats service you're using is it?

Robber

8:40 am on Apr 21, 2004 (gmt 0)

Hi jomaxx,

thanks for that, I'll try it.

Nah its not the stats stuff, thats been there for donkeys years - its only there because the global search and replace didnt pick that line up.

The problem is on other newer sites that dont have that stats script on it.

Thanks

Robber

8:43 am on Apr 21, 2004 (gmt 0)

BTW, I found a short term bodge to at least stop it troubling visitors.

I tried thinking of some js to do it eg window.stop() and document.execCommand("Stop"); but they didnt work so I changed my plan. I have set it up so that the js will now be enclosed in an iframe, that seems to stop it from executing.

Just wish I could get to the root of the problem now.